CVE-2026-112111: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Bootstrap Shortcodes project Bootstrap Shortcodes

CVE-2026-112111 describes a stored XSS vulnerability in the Bootstrap Shortcodes WordPress plugin prior to version 3.4.6. The bs_tcontent() shortcode handler in inc/bs_tabs.php outputs the id attribute value into an unquoted HTML attribute. Although esc_attr() is applied, it fails to encode space characters, which allows an attacker to terminate the attribute early and inject additional HTML attributes, including JavaScript event handlers. This enables authenticated attackers with Contributor-level or higher privileges to inject arbitrary scripts that execute in the context of users viewing the page.

An attacker with Contributor-level or higher access can inject malicious JavaScript into pages using the vulnerable shortcode. This script executes in the browsers of users who view and interact with the injected element, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires authentication and user interaction, limiting its scope but still posing a risk to site visitors and administrators.

A fixed version 3.4.6 or later of the Bootstrap Shortcodes plugin should be applied once available. Since no patch links are provided, users should monitor the vendor's official channels for the release of the fix. Until then, restrict Contributor-level access and above to trusted users only and avoid using the vulnerable shortcode with untrusted input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.